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[57] ABSTRACT 

In a method of communication using quantum cryptography, 
single-photon signals from a highly attenuated source are 
modulated and subsequently detected. In the step of detect- 
ing the modulated signal, the signal is split between two 
branches according to its encoded state. Signals correspond- 
ing to different encoded states are detected independently in 
the respective branches and the rate of detection of coinci- 
dent signals is determined. This rate is compared with a 
threshold to detect the presence of an eavesdropper. 

10 Claims, 8 Drawing Sheets 
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QUANTUM CRYPTOGRAPHY optical fibres already achieve the theoretical minimum loss, 

making it technically very difficult to substitute a channel of 
BACKGROUND TO THE INVENTION lesser loss, especially for channels of km lengths or greater. 

The present invention relates to a communications system 71,6 e»vwdropper might alternatively use an intercept/ 

r t . , 5 resend attack. As the name suggests, this involves the 

using quantum cryptography. eavesdropper detecting destnictivdy incoming signals and 

As described in the present applicant's earlier applications then re . S ending an appropriate modulated signal for detec- 

Nos. PCT/GB93/02637 and PCT/GB93/02075, quantum t i on at the receiver. However, when the original intensity 

cryptography is a technique for the distribution of a key for level is significantly less than 1, then retransmitting photon 

use in the subsequent encryption or decryption of transmis- signals at that same intensity level in response to every 

sions in a communications system. The key is distributed by detection at the eavesdropper causes a dramatic reduction in 

modulation of a single-photon signal. Any eavesdropper the count rate at the receiver. This can be understood in 

intercepting the single-photon signal disturbs the statistics of terms of the eavesdropper replacing a detected single photon 

the received data, and so can be detected. The term "single- by a signal which will result in the detection of a photon at 

photon signal" encompasses any signal having the required the receiver on only one occasion in ten, in the case of an 

quantum properties. It may be a true single-photon 35 intensity level of 0.1. The statistics of this process are 

generated, for example, by parametric down-conversion. described fully and treated more rigorously in the theoretical 

Such a technique is described and claimed in our earlier discussion below. 

above-cited applications. Such true single-photon sources To avoid this reduction in the count rate at the receiver, the 

have been found however to be difficult to construct and run eavesdropper might increase the intensity of the single 

reliably. In general therefore it is preferable to take a 20 photon signals it transmits on. On the basis of the simple 

"classical" source, such as a laser diode (LED) and to reasoning used above, one would expect that by increasing 

attenuate severely the output from such a source to a level the average intensity to be equal to 1, the variation in count 

such that in a given time slot there is in general no more than rate at the receiver should be eliminated. While in practice, 

one, and on average very much less than one photon. for receivers of finite efficiency, this is the case, the genera - 

25 tion by the eavesdropper of signals of increased intensity can 

SUMMARY OF THE INVENTION be detected according to the present invention as a result of 

According to a first aspect of the present invention, there a corresponding increase in coincidence counts at a beam 

is provided a method of communication using quantum splitter at the detector. 

cryptography including the steps of modulating a single- 3Q The step of detecting the rate of coincidence may include 

photon signal from a highly attenuated source, and detecting detecting coincident signals in real time using a coincidence 

the modulated signal, characterised in that in the step of gate connected to a pair of single-photon detectors. Prefer- 

detecting the modulated signal the signal is split between ably however the step is carried out after the detection of the 

two branches according to its encoded state, and signals single-photons by processing of data recorded for different 

corresponding to different encoded states are detected 35 time slots. In this case preferably the signals from different 

independently, and in that the rate of detection of coincident branches are recorded at different respective detectors, but 

signals in the two branches of the detector is determined and alternatively a single detector might be used, with the signals 

compared with a threshold to detect the presence of an from the different branches separated in the time domain by 

eavesdropper. a delay introduced in one of the branches. 

The present invention uses properties specific to signals 40 The step of splitting the modulated signal between two 

from an attenuated source, and the eavesdropping tech- branches and detecting the rate of coincidence signals may 

niques necessary to attack a signal from such a source, to be carried out for those single-photon signals determined to 

provide a new approach to the detection of any eavesdrop- have been modulated and detected using different bases, 

per. This enables the method of the present invention to It can be shown that where different modulation and 

provide enhanced security for the quantum cryptographic 45 detection bases are used in a four-state encryption protocol 

techniques previously proposed by the present applicants as described below, that this is formally equivalent to 

and others, and can also make possible the use of certain measurements carried out with a beam splitter. The signals 

simplified encoding techniques for the quantum signal may therefore be used for coincidence detection, 

which, without the approach of the present invention, would Alternatively, the single-photon signal may be modulated 

not offer adequate security. 50 using a basis comprising two non-orthogonal states, and the 

When a highly attenuated source is used, the attenuation step of detecting the rate of coincidence may be carried out 

is set at levels sufficient to make it highly unlikely that more in relation to signals determined at the receiver to have been 

than one photon would be present in any given time slot. To encoded with a known state at the transmitter, 

achieve this the average number of photons per time slot has As further described below, the present invention can be 

to be considerably less than one. For example, the average 55 used to enhance significantly quantum cryptography using 

level n may be 0.1. two non-orthogonal states. Such a two-state scheme, as 

An eavesdropper attempting to intercept the encoded key proposed hitherto, has required the use of a multi-photon 

data might use a beam splitter to split off a fraction of the reference pulse transmitted within a very short time of the 

photon power while leaving the remainder to be transmitted single-photon pulse. However detecting a second pulse on a 

on to the receiver. This however would in general lead to a 60 short time scale present serious practical problems because 

marked reduction in the detection rate at the receiver unless of the dead time of typically 1 /*S associated with appropri- 

the splitting ratio was very small, in which case the amount ate photon detectors. The present invention, through the use 

of useful data which the eavesdropper could extract would of coincidence detection, is able to make the two-state 

be very limited. In practice all real channels suffer from scheme secure without requiring the transmission and dctec- 

finite loss and this opens the possibility of a beamsplitting 65 tion of reference pulses. 

attack in which the eavesdropper compensates for her beam- The present invention is not limited to use with point-to - 

splitting loss by substituting a lower loss channel. However, point links, but may also be used with a variety of network 
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topologies including, branched or star topologies, and such a source are exploited to facilitate the detection of any 

looped-back or ring topologies as described in further detail eavesdropper intercepting the modulated signals transmitted 

below and described and claimed in our co-pending Inter- on the medium 4. In particular, a rise in the coincidence 

national Applications Nos. PCT/GB 94/01953 and PCT/GB detection rate is detected when an intercept/resend attack 

94/01952 5 occ urs. FIG. 7 shows an experimental demonstration of this 

Using current technologies, quantum cryptography has f£ in ,he con,ext . of a s / stem such 45 ' hat shown in BG - 

been implemented successfully over optical fibre links as }: ^ experiment is used to represent the communication 

long as 30 km [C. Marand and P. D. Townsend, Optics hnk between the eavesdropper (transmitter) and the receiver 

Utters, vol.20 Aug. 15, 1995] and so is suitable for a wide 1 - e , the . rese ° d P a « of lhe a " ack - ™ e by 

range of industrial applications including LANs, campus- » replacmg the random number generators and modulators by 

wide networks and MANs (Metropolitan Area Networks). It a s,atic f P°^^ controller set so that the polarisation 

may also be used for secure links, for example, between two state 0 P h ° ° DS , arr '™8 a » ,he "nsrai er is constant, 

core servers in a larger optical telecommunications network. «U*r circular (right or eft) or diagonal linear (+45 or 

° . -45 ) states selected. The polanser in the receiver is oriented 

According to a second aspect of the present invention such that veftical (0 -) Unear stales are routed l0 detector x 

there is provided a communications system for use in a and horizontal (9r n states routed t0 delector 2 . In this 

method of quantum cryptography comprising a transmitter case the experiment continuously simulates the portion of 

(7) including a highly-attenuated optical source, one or tQe quantum key transmission for which the eavesdropper 

more receivers (R1-R3) and a network linking the trans- faas chosen a diffcxcTli basis t0 the receiver and hence there 

milter to the or each receiver, characterised m that the ^ a finite probability of a coincidence count. FIG. 7 shows 

receiver includes means for determining the rate of detection faow the ratio of the number of ^^0^ events (count in 

of coincident signals in branches of the receiver correspond- 6g{cc[qt j afld detect0f 2) tQ the Qumber of singles eyents 

ing to different encoded states and compares the rate of (c0UQt in detect0f ± only) changes as the eavesdr0 p per 

detection with a threshold to detect the presence of an mcreases the average Dumber Q f photons n in the resent 

eavesdropper. ^ pulses The ratio is of the order of 2xl0" 3 for n=0. 1 and rises 

nmrr nccroiDTiAvr nc Tun no au/tmpc to 2xl0~ 2 for n-1. The straight line is a plot of equation 8 

BRIEF DESCRIPTION OF THE DRAWINGS , , ( u i c i c m-2 a t 1 to. i « 

below with values of T|«3.5xl0 and T»l. Ine latter 

Systems embodying the present invention will now be represent the experimentally measured values of the detec- 

described in further detail, by way of example only, with tion efficiency of the germanium APDs and the transmission 

reference to the accompanying drawings in which: 30 coefficient of the optical fibre channel respectively. As 

FIG. 1 is a schematic of a point-to-point system embody- alread V discussed, even if the channel between the legitimate 

ing the present invention; transmitter and the eavesdropper is lossless and the eaves- 

— rj. — . . , , _ . , 4 dropper has perfectly efficient detectors (tj=1) the count rate 

FIG. 2 is a plot of the eavesdropper transmission intensity at t ^ receiv ^ r wiu £ Iow if both the eavesdropper 

n as a fiinction of receiver detector efficiency; ^ and ^ transmiUer use Qss01 pulses consequently, the 

FIG. 3 shows coincidence detection probabilities with and eavesdropper is forced to resend pulses with n-1 in order to 

without an eavesdropper; keep tne s i n gi es count rate approximately constant. The 

FIG. 4 is a detailed schematic of a system embodying the experimental data in FIG. 7 shows that in this case there is 

invention; a dramatic increase in coincidence count rate that reveals the 

FIG. 5 shows an alternative embodiment using a multiple 40 presence of the eavesdropper, 

access ring topology; FIG. 4 shows in further detail a system embodying the 

FIG. 6 shows a further alternative multiple access topol- present invention. The transmitter 1 includes a pulsed semi- 

0 gy. conductor laser which may be, e.g., a DFB laser. One 

FIG. 7 is a plot of experimental data showing coincidence ""fPf °L ™ a PP«>P" ata device is an Hitachi series 

detection as a function of average photon number; and « HL ™ ?™ laser , dl °f "P"*"* at 5 ? W °P Uca » P ower 

. . . at 1290-1330 nm. In the present example, this scheme is 

FIG. 8 is a schematic of a liquid crystal polarisation implemented in an optica l fibre-based form (FIG. 4), in 

modulator. which both the quantum channel and the public channel are 

nEcpnTTmr.\r ^r? rvAum r?c transmitted on a transmission fibre 3 linking the transmitter 

DESCRIPTION OF EXAMPLES . _ , , ° . , 4 

50 1 to the receiver. In the transmitter a pulsed semiconductor 

An optical communications system 1 configured for the laser 48 provides the optical source. The laser 48 and a 

distribution of a key using quantum cryptography comprises modulator driver 49 for a phase modulator 41 are controlled 

a transmitter 2 and a receiver 3 connected by a transmission by a microprocessor 50. The receiver 2 has its own local 

medium 4 which may be, for example, an optical fibre link, control microprocessor 54 which controls a respective phase 

A polarisation modulator 5 in the transmitter 2 randomly 55 modulator 42 via a modulator driver 52. The receiver control 

encodes outgoing single -photon signals in response to a data processor also controls a detector bias supply 53 for two 

stream from a random number generator 6. A further random detectors 43,44. In both the transmitter and the receiver, 

number generator 7 in the receiver similarly controls a where the signal path branches fused-fibre 50/50 couplers 

respective polarisation modulator 8. The output from the are used. Suitable couplers are available commercially from 

receiver polarisation modulator passes to a polariser which go SIFAM as model P2S 13AA50. 

directs the optical signal to one or other of two single-photon Appropriate modulators 41,42 for the data encoding and 

detectors 10,11 depending on their polarisation state. The decoding are lithium niobate or semiconductor phase modu- 

outputs of the single-photon detectors 11,10 are monitored htors operating at e.g. 100 MHz, Alternatively, liquid crystal 

by a coincidence counter 12. polarisation modulators may be used. FIG. 8 shows a 

The single-photon source 2 is an attenuated classical 65 polarisation modulator 81 comprising a stack 82 of liquid 

source which may be coherent or incoherent. As described crystal cells. In the example of FIG. 8, the stack comprises 

in further detail below, the statistics of signals produced by two chiral smectic-C cells SI, S2. Each cell comprises a pair 
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of glass substrates gl, g2 with an InTiO electrode E formed biased beyond reverse breakdown and operate in the Geiger 
on each substrate. A polyimide coating, rubbed in one mode with passive or active quenching, as discussed in R G 
direction is formed on each of the electrodes. The rubbing W Brown, K D Ridley and J G Rarity; Appl. Opt. 25 4122 
directions on top and bottom substrates are usually opposed (1986) and Appl. Opt. 26, 2383 (1987). The key distribution 
to minimise the stored splay elastic energy arising from the 5 protocol requires each received photon to be associated with 
slight surface pretilt of the liquid crystal molecules. a given clock period and also identified as a 0 or 1 depending 
Although polyimide alignment layers are preferred, other upon which APD it is detected at. These functions are 
planar alignment materials are possible e.g. rubbed nylon, performed by a time interval analyser 45 (e.g. Hewlett- 
rubbed polyvinyl alcohol, or obliquely evaporated silicon Packard 53310A). The start signals for this device are 
oxide or magnesium fluoride. On balance polyimides have 10 provided by the APD outputs after processing by a circuit 46 
so far tended to give the best all round performance. As an comprising amplifiers and discriminators connected in series 
alternative to the structure of FIG. 8, a single double-sided ^th each output and an OR gate connected to the discrimi- 
substrate may replace the upper substrate of SI and the nators (e g. Lecroy 612A, 821 and 622) l^e stop signals are 
lower substrate of S2. spacers SP separate the substrates and £™ ded b ? the cloc * regenerator which is described below 
define a volume in which the liquid crystal material is 15 ™% detection procedure is described m P. D. Towr^end J 
a JO ... u i ♦ j I#u u 35 G. Ranty and P. R. Tapster, Electronic Letters, 29,634(1993) 
confined Spacer material may be located at the Periphery or and ^ (1993) P silicon such as the SP CM-100- 
scattered, possibly randomly throughout the cell. An adhe- pQ {QE Canada E , eclr0 Optics) can be used in the 400-1060 
sive seal may be applied to one of the substrates to define the flm wavelength range( while germanium or InGaAs devices 
lateral boundary of the cell. The seal will have one or more such as the NDL5102P or NDL5500P (NEC) can be used in 
gaps to permit capillary filling (under vacuum if only one 20 the 1000-1550 nm range. 

gap is used) with liquid crystal. There is a wide range of M QOted above ^ ideally the quantum channel uses pulses 

ferroelectric liquid crystal (FELC) and liquid crystal mix- containing at most one photon. This situation is approxi- 

tures available commercially that may be used in such mate d by connecting an attenuator 55 in line with the laser 

devices, for example a suitable material is that available source in order to reduce the intensity to a level such that the 

from Merck as ZLI-4318. A complete listing of available 25 average number of photons per pulse, n, is about 0.1. 

ferroelectric mixtures is available from Merck Ltd, at Merck As seen in FIG. 4, an alternative mechanically switched 

House, Poole, Dorset, BH15 1TD, UK. pa th 56 is provided for the output from the laser, which 

The spacing between the glass substrates in each cell is bypasses the attenuator or single-photon source. The switch 

typically in the range 1.5 to 2 fim. The thickness of each cell may be, e.g., JDS-Fitel SW12. This provides the public 

and refractive index anisotropy of the liquid crystal is 30 channel at the same wavelength as the quantum channel but 

chosen so that at the wavelength of the input beam the cell using bright multi -photon pulses. The large intensity of these 

functions e.g. as a half-wave or quarter-wave plate. In the pulses would lead to saturation and current heating effects in 

present example, the liquid crystal material is assumed to the single -photon detectors. In order to avoid this happening, 

have a typical birefringence of 0.15. Therefore, for operation the reverse bias on the APDs is reduced well below break - 

at a wavelength of 830 mn, for ope ration as a half-wave plate 35 down so that the devices operate with greatly reduced 

the cell is arranged to have a thickness of 2.8 jum, while a sensitivity in the standard analogue mode. Alternatively the 

quarter- wave plate uses a cell of half that thickness. APDs may be isolated by means of electromechanical 

If the liquid crystal material has a different birefringence, optical switches, similar to that used in the transmitter, or 

then the cell thickness is scaled accordingly. Selected FELC' using electro-optic switches, which route the multi-photon 

materials may have birefringences as high as 0.5. However, 40 pulses to an additional standard detector such as a p-i-n 

more typically, FELCs have birefringences in the range photodiode. Alternatively, the public channel may be 

0.15-0.13 at 589 nm. When a field is applied across each cell encoded on a different wavelength propagating though the 

using the electrodes, the liquid crystal molecules in the cell same fibre transmission link. In this case, the public channel 

tilt at a characteristic tilt angle 6. Changing the polarity of is routed to a standard detector using wavelength-sensitive 

the applied field flips the molecules through an angle of 20. 45 couplers. Additional isolation at the quantum channel wave- 

The cell functions as a bistable device which is switched by length may be provided by means of wavelength-selective 

the field between these two stable orientation states and can filters. 

not in general have any stable intermediate orientations. Since this channel operates with many photons per pulse, 

Ferro-electric chiral smectic C materials possess a strong it is classical in nature and is therefore open to attack by any 

spontaneous polarisation at an angle approaching 90° to the 50 eavesdropper. This channel provides the public channel for 

longitudinal direction of the molecule. It is this spontaneous the encoding protocol. The transmitter and receiver com- 

polarisation that interacts with the electric field. The surface municate on this public channel to exchange information on 

stabilisation and the chirality of the material ensures that which encoding/decoding alphabets were used for given 

when the spontaneous polarisation reverses during signal pulses. On the basis of this data, the statistics of the 

switching, then the layer tilt flips from +0 to -0 in the plane 5s signal received at the receiver can be analysed to determine 

orthogonal to the applied electric field. The magnitude of the whether the key has been received securely, or whether an 

layer tilt is not altered by the field, but only its rotation sense. eavesdropper has intercepted any part of the key. 

It should be understood that there is no tendency for the In addition to use for this public discussion stage of the 

longitudinal axis of the molecules to line up with the electric protocol, the public channel is also used to calibrate the 

field, i.e. for them to tilt relative to the cell walls. The layer 60 transmission system. Over a long optical fibre link, which 

tilt is always induced in the plane along the field direction, may be as long as say 50 km, unavoidable environmental 

Bistable FE switching can be observed at voltages typically effects on the fibre, such as temperature fluctuations, cause 

up to +/- 50 V jum" 1 or more before they break down. both the polarization and phase of the transmitted pulses to 

Appropriate single photon detectors would be, for vary slowly and randomly with time. The calibration step 

example, semiconductor avalanche photodiodes such as 65 makes it possible to correct for these variations, as described 

those described in B. F. Levine, C. G. Bethea and J. C. in our above-cited International application PCT/GB93/ 

Campbell, Electronics Letters, 20 596 (1984). These are 02637. 
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FIG. 6 shows a multiple access network for use with the tions or statistical mixtures respectively of n-photon states 
present invention. Although in the example of FIG. 6, only which obey Poissonian statistics (although this is not crucial 
two receivers are shown, in practice networks employing for the operation of the quantum cryptography scheme), 
greater numbers of receivers will often be used. The number Consequently, the probability that the source generates an 
chosen will vary according to the field of use. For a local 5 optical pulse containing n-photons is given by 
installation on a single site, the network might comprise only 

ten receivers or terminals. By contrast, for a public network (1) 
several tens or even a hundred or more receivers might be p n = 

connected to the network and would receive quantum keys n! 
distributed from a single -server. Any one of a number of 1Q 

different configurations can be used for the network, A . . „ rtf t . Uma :iw* r , t ^ ,*„ 1 

, n & , , . t a I A typical receiver, 01 the type illustrated in FIG. 1, 

including, for example, tree, bus, nng or star configured * • j * * u 1 u u ♦ ^ /Ann 

, B ' u- *■ .u f contains a detector such as an avalanche-photodiode (APD) 

networks, or combinations thereof. __ . i_- j u • j . 

, , , c . c . , t . . that is reverse-biased beyond breakdown in order to achieve 

FIG. 6 shows a specific example of a broadcast network . . ■ * 1 i» # 1 it, . t , t 

containing two receWer, and a transmitter. The transmitter f 6 "*™* ^ the single photon level. The probability that an 

consists of a gain-switched semiconductor laser 9, of the 35 mc0 ™*% °P Ucal £ ulse g enerates n photo-electrons in such 

type described above, an attenuator or intensity modulator an APD 15 8 iven b y 

67, and a polarisation modulator 68 and control electronics 

70. The single-photon detectors in the receivers may be the _ {nijiTe'^ 7 (2) 

same devices as described in the first embodiment discussed p *~ „ » 

above. Each receiver includes a microprocessor control unit 20 
62, which receives the output of the APD via a 

discriminator/amplifier circuit 63. The control unit 62 also where y\ is the quantum efficiency of the APD, and T is the 
controls an electronic filter 64 and local oscillator 65, as well transmission fraction or coefficient of the quantum channel, 
as the APD bias supply 66. The electronic filter 64 isolates As discussed in P. D. Townsend and I. Thompson, Journal of 
the first harmonic of the frequency spectrum of the signal 2 5 Modern Optics Vol 41 p.2425 1994, the optical pulse dura- 
output by the APD in response to synchronising pulses tion is generally chosen to be much shorter than the APD 
received via the network. This generates a sinusoidal signal dead-time. Hence, the APD can generate at most one voltage 
at the pulse frequency which locks the local oscillator 65. pulse per optical pulse, and the probability that this occurs 
The output of the local oscillator 65 is received at the control is given by 
unit 62 to provide a timing reference during quantum 30 

transmissions. p ( fi ^i) ml ~ p (^T 1 ~ e ' anT ( 3 ) 

FIG. 5 shows a further alternative embodiment using a Co nll the receiver . s counl rate wiu be 

ring topology. The system comprises a transmitter/exchange n J 

T connected to three receivers R1-R3 via a passive optical 

network N having a ring topology. The transmitter T 35 -e^ 7 ) (4) 

includes both a quantum channel source 71 for use in 

establishing a key by quantum cryptography, and also a where R f is the rate at which the attenuated source in the 
conventional intensity-modulated source for outputting transmitter is pulsed i.e. the time-slot frequency. We see 
multi-photon signals for the calibration phase and also for from equation 4, that when n«l and T|=T=1 then 
carrying conventional traffic. The quantum channel source 4 q 

71 and standard source 74 operate at different wavelengths R/**R, (5) 

X„ and X r respectively. The output from the quantum source *u . • * • 1 1^ 

* u 1. i_ 1.1 . it\ ji 1 ■ s° tnat tne receiver s count rate is always less than the 

1 passes through a switchable attenuator 79 and a polanser .. . . . ., . . , 

v. 1 j *i. « j . .u * u 1 time-slot rate even in an ideal system. In order to explain the 

and band-pass filter 78 tuned to the quantum channel wave- - lL j . *• i_ j 

1 h > operation of the new detection scheme, we now consider a 

en ^ ~<r t . „ , . , 45 generalised receiver in which the output of the quantum 

Each receiver or node comprises a first multi-photon channe , fe {[{ between tWQ brancheSj each of which is 

detector 75 for the signal on channel k s , a detector 80 for monitored by a single photon detector SuCD a split cou i d be 

multi-photon timing signals at the quantum channel wave- achieved b means of a fibre lw for example) however, 

length \ q , and a modulator 72, which in the present example we show ^ mat ^ feceiver iUustrated in FIG . x also 

is a polarisation modulator The clock detector 80 is con- 50 performs this function. Taking the example ofa fibre coupler 

nected to the network N by a fibre coupler 81 which provides ^ a ^ fatio p:(1 _ p)> and following the proC edure 

a weak tap at \ q . These taps have low coupling fractions 0UtHned aboye ft can be seeQ mat lhe CQUnl fate for tfae p arm 

(e.g. of the order 1%) in order not to introduce excessive de tector is 
attenuation in the quantum channels. Alternatively if a 

separate wavelength X c is used for the calibration signals 55 R^^i-e-^ 1 ) (6) 
then WDM couplers which have a finite coupling fraction at 

K c and ideally a zero-coupling fraction at \ q can be A similar expression with (3 replaced by (1-p) is obtained 

employed. The detector 75 for the signal wavelength is for the count rate for the other detector. If the two detectors 

connected to the network by a WDM (wavelength division are connected by an appropriate coincidence detection 

multiplexer) coupler 77. The WDM is a fibre coupler with a 60 circuit, the coincidence count rate will be 

wavelength-dependent coupling characteristic. In the ^ 

present example the WDM provides a straight- through route R^R^-e^ 1 ) (l-c 1 0 (7) 

for the quantum channel i.e. the coupling fraction out of the , Q ^ ific Q ^ of p-a5 ^ coincidence rate can be 

loop is small at \ whilst at the signal wavelength \ s the convenieml normalised by the singles rate (equal for both 

coupling fraction has a much larger value F x . 65 arms) tQ gi 4 lne fatio 

Attenuated coherent or incoherent sources of the type 

used in the present invention typically produce superposi- c=(i=e _(fl1l7/2) ) (8) 
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which is essentially the probability_for an incoming pulse to R,=RjLi-c-^ T ')-R,(i- e -* tT * T ')(i-c^ r ') (10) 

be split into two. In the case of n=0.1, this probability is _ _ 

small i.e. 00.05, showing that the attenuated pulses behave For n f =n tf «l, this leads to a dramatic reduction in count rate 

on the whole like indivisible particles. For true single at the receiver, e.g. for ti^^T^T^I, 

photons the coincidence rate is zero, since splitting never 5 
occurs. 

We now consider an eavesdropper on the quantum R * t 11 ) 
channel, and the two types of measurement strategy that „ . , . . , , . . t t e 
could be employed. In the first strategy, the eavesdropper Evidently - such large reductions in count rate e.g 90% for 
performs a "beamsplitter attack" in which an attempt is 1rt n -°- 1 - wou J d alarm the receiver - Consequently, the eaves- 
made to split the attenuated optical pulses. In this way a 10 dropper is forced into a strategy where the receiver's count 
measurement could be performed on one half of the pulse, rate is ke P l constant (at least to within the power fluctuations 
whilst the other half is left to propagate on to the receiver of the source, as discussed above) by increasing the value of 
who would then be unaware of the eavesdropper's presence. for the retransmitted pulses above the value n, for the 
However, as shown above, the attenuated coherent pulses incoming pulses. Hence, by equating (4) and (10) and using 
are difficult to split in this way and only a small fraction of 15 the fact that n, is small, we find that 
the pulses, and hence the key bits that they carry, will be 

leaked to the eavesdropper. Nevertheless, as discussed in ff 1 iJ l?fTg ] tl2) 

Bennett et al. J. Crypt. 1992 it is important to take this ' ~ rj r T r "Ujv-^tJ 
fraction into account when calculating the total information 

leaked to the eavesdropper during the error correction and 20 

privacy amplification stages of the quantum cryptography For a P erfect svstem in which ^V^r-T^-TV-l, n e must 

protocol. Another important consideration is that the eaves- tead t0 *&™*y * the eavesdropper wishes to guarantee that 

dropper's beam splitter attack inevitably leads to a reduction each P uise sent on t0 the receiver is definitely detected, 

in the receiver's count rate. For example, if the splitK)ff However, equation 12 shows that for more practical values 

power fraction is (1-p) then the received count rate is given 25 of detector eflSciency (<80%) the eavesdropper needs in 

by equation 6, and comparison with equation 4 shows that general to increase n e to at least 1. This is illustrated by the 

the rate is reduced by the fraction (3 appearing in the curves in na 2 which show the variation of n , with the 

exponent. Evidently, if (1-p) is large the receiver will receiver's detector efficiency for four discrete values of the 

experience a large reduction in count rate and will be alerted eavesdroppers detector efficiency. We note also that the 

to the eavesdropper's presence. A sensible strategy for the 30 increase in n e is independent of the value of n, for the 

eavesdropper would then be to reduce the count rate at the incoming pulses from the transmitter, 

receiver by no more than the expected power fluctuations We have alread y seen that the average photon number 

from the transmission source. If, for example, such temporal of an attenuated coherent pulse increases it becomes easier 

power fluctuations could be maintained at e.g. £±10%, a t0 s P ht mt0 two - Consequently, if the receiver performs a 

value which is readily achievable in practise, then the 35 beam-splitter measurement of the type discussed above, the 

eavesdropper should use (1-0)^0.1 in order to avoid setting rate of coincidence detections will be greatly increased in 

off the alarm. However, in calculations of information the presence of an eavesdropper. FIG. 3 shows the norma- 

leakage to the eavesdropper a much more conservative lised coincidence probability defined by equation 8 plotted 

estimate of (l-p)=l is usually taken (Bennett et al, J. Crypt as a function of n, with and without the eavesdropper 

1992). This takes into account the possibility of compen- 40 P reseDt - In this case the channeI was assumed to be loss-less 

sating for a beamsplitting attack by the insertion of a lossless and the detector efficiencies for the receiver and eavesdrop- 

or lower loss channel. As discussed above, this type of attack P er were taken t0 be 0 8 and 10 respectively. It can be seen 

presents severe technical difficulties, but it nevertheless that the increase in coincidence probability becomes more 

represents an absolute worst case and therefore allows a very and more marked as n, decreases. The technique is therefore 

safe estimate of the secrecy of the key to be obtained. In 45 attractive for enhancing the probability of eavesdropper 

considerations of the second type of eavesdropper attack, detection. However, coincidence measurements using a 

called "intercept/resend", the receiver's ability to monitor 50:50 C0U P ler or beam s P litter would have t0 be carried out 

changes in the count rate is all-important and, as will be separately from measurements normally performed during 

discussed, underpins the current invention in a fundamental the course of quantum key distribution. This would both 

wav 50 complicate the design of the receiver and also waste poten- 

In intercept/resend the eavesdropper breaks into the chan- tial ke y bits. Instead, we propose using the data that would 

nel and attempts to measure, and then send on copies of, the normally be discarded in the Bennett/Brassard four-state 

key data. Of course the quantum cryptography protocol is cryptography scheme. For example, in the case of the 

designed to detect the errors in the key that the eavesdrop- experimental scheme illustrated in FIG. 1, random key 

per's measurements unavoidably generate. However, the 55 sequences are transmitted over the channel by encoding the 

current invention achieves significant improvements in this polarisation of the attenuated optical pulses using modula- 

detection probability by exploiting properties of the attenu- lors * the transmitter T and receiver R. T uses two different 

ated coherent states used in practical systems. In particular, representations for the binary digits (0,1), namely (0°, 90°) 

by analogy with equation 4 we see that the eavesdropper's and M 5 '* +45 )> and randomly switches between them 

count rate will be 60 dur ing key transmission. R also switches randomly and 

independently between measurement polarise r angles of 0° 

K-Rfc-e *** e ) (?) aflC j ..450 ^er the transmission, R uses a public channel to 

where we have introduced the subscripts t, e and r to denote tell T in which bit-periods a photon was received and which 

parameters specific to the transmitter, eavesdropper and polariser measurement angle was used, but not the result i.e. 

receiver respectively. If the eavesdropper sends on a pulse 65 whether the photon was detected at the 0 or 1 output ports, 

containing n^ photons every time an incoming pulse is T then publicly reveals the bit-periods for which the sent and 

detected, then the receiver's count rate will be measured polarisation angles differed by A9-0° or 90°, and 
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only this half of the data is retained. For these cases the 
photons ideally have unit probability of being observed at 
the correct polariser output port, and consequently, the 
transmitted and received bit sequences should be the same. 
If an eavesdropper tries to intercept and resend the key these 
final shared strings will have a substantial error rate typically 
around 25% [Bennett et al J. Crypt 1992], which T and R 
check for by publicly comparing, and then discarding, a 
random subset of their data. These errors arise from the 



does not determine the bit as in the four-state scheme, hence 
the change in labelling scheme from 0 and 1 to C and D). For 
the other cases in which (<(>,-(|> r )=±90 o the photons behave 
probabilistically at the final coupler and are equally likely to 
be detected at C or D. Consequently, on average V* of the 
receiver's detections will occur at the C port and Va will 
occur at the D port. The former data is discarded whilst the 
latter 30 is used to generate the key. The receiver uses the 
public channel to tell the transmitter in which time-slots the 



instances in which the eavesdropper has unknowingly made 10 D-events occurred. At this point they are in possession of a 
the wrong type of measurement on the channel such that e.g. shared key, since the receiver knows that a photon is only 
A0=+45°. In such cases the outcome of the measurement is observed at D if (<j>,-<|) r )=±90 o and can therefore calculate <(>,, 
probabilistic and a pulse is equally likely to be registered as and hence the bit, from its knowledge of <J> r . 
0 or a 1. This leads the eavesdropper to sometimes send on Of course this is only the case for an ideal noiseless 
the wrong bit thus causing an error in the cases where T and is system with no eavesdropper on the transmission channel. In 
R expect perfect agreement. Returning now to the coinci- a real system the transmitter and receiver need to check that 
dence detection scheme, we note that polarisation measure- the error rate is not so high as to indicate continuous 
ments with AG =±45° are formally equivalent to measure- eavesdropping on the channel, and then perform error cor- 
ments with a 50:50 beam splitter. This is because the rcction and privacy amplification on their shared bit 
transmission probability for each output port of the polariser 20 sequences in the normal way [Bennett et al, J. Crypt., 5, 3 
is equal to 50% in this case. Other coding bases give (1992)]. As described so far, the current scheme has the 
different splitting ratios, e.g. a four-state scheme using advantage of only requiring a simple two-level modulation 
(0°,90°) (-22.5°,+67.5°) is equivalent to a 15:85 beamsplit- scheme, however, it is vulnerable to a particular type of 
ter at the receiver and the probability of coincidences is intercept/resend attack. Specifically, if the eavesdropper 
reduced, although still larger for small n, than in the absence 25 performs measurements on the channel using the same 
of the eavesdropper. Consequently, R can take the rejected apparatus and phase-shifts as the receiver, then a prob ap- 
portion of the data and look for coincidence events in which listic outcome i.e. a detection at the eavesdropper's D port 
both the 0 and 1 detectors registered a count in the same allows the eavesdropper, just like the receiver, to calculate 
time-slot. This coincidence rate can then be compared with unambiguously which bit was sent by the transmitter, 
that expected for the known value of n, with no eavesdropper 30 Consequently, if the eavesdropper retransmits only in these 
present. As already shown, if the eavesdropper is present and (~1 in 4) instances pulses with sufficiently increased average 
the received count rate is close to that expected from the photon number, then the receiver will see neither an 
known system parameters, then the coincidence rate will be increased error rate nor a decreased detection rate. In the 
greatly increased especially for small values of n r In original Bennett scheme this type of attack was prevented by 
summary, the users of the system can enhance their ability 35 the use of a novel reference pulse technique. However, this 



to detect eavesdroppers simply by performing additional 
analysis on data that is collected, but not used, in the 
standard protocol. The technique exploits properties of the 
attenuated coherent states used in practical systems and 
requires no extra components or equipment. 

Although the examples above use four-state encoding, 
other schemes may be used. 

Recently, Bennett [Phys. Rev Lett., 68, 3121, (1992)] has 
developed a quantum cryptography scheme which uses only 



requires the single photon detector in the receiver to detect 
a second pulse a short time after the signal photon arrives, 
and this may be impractical in real systems due to the 
dead-time (typically ~1 fits) associated with such detectors. 
40 Instead, we use the coincidence technique described above 
to detect this eavesdropping strategy. Now the receiver 
checks the time-slots in which a D-event was recorded to see 
if a detection also occurred at the C port. As already 
discussed, the receiver's measurements are equivalent to 



two non-orthogonal states rather than two bases each con- 45 beam-splitter measurements in these instances, and the prob- 



taining two orthogonal states as in the example used above. 
We shall describe the operation of this scheme by reference 
to a specific example that is simpler and more practical than 
the version considered by Bennett. Most importantly, we 
will show how the coincidence detection technique can be 50 
used to make this simplified scheme, which would otherwise 
be vulnerable to an eavesdropper, secure. 

We shall take the example of a phase encoded scheme in 
which the binary digits 0 and 1 are represented by phase 
shifts of 0° and 90° respectively. Such a scheme could be 55 
implemented with a system identical to that shown in FIG. 
4. The key distribution proceeds with the transmitter ran- 
domly encoding each pulse with one of the two phase shifts, 



ability of a coincidence event is much larger if the photon 
number of the pulses has been increased by an eavesdropper. 
In the four-state scheme the eavesdropper must use n~l for 
the retransmitted pulses in order to maintain the receiver's 
count rate, but here the eavesdropper must increase n to an 
even larger value (that depends on detector efficiencies) 
since only 1 in 4 of the detected pulses are sent on to the 
receiver. 
I claim: 

1. A method of communication using quantum cryptog- 
raphy including the steps of modulating a single -photon 
signal from a highly attenuated source, and detecting the 
modulated signal, characterised in that in the step of detect- 
ing the modulated signal the signal is split between two 



and the receiver randomly choosing one of the two phase 

shifts for the measurement of each incoming pulse. When 60 branches according to its encoded state, and signals corre 

the difference in the transmitter and receiver phase shifts sponding to different encoded states are detected 

(<t> r -(|> r )=0 o the single-photon interference is fully construe- independently, and in that the rate of detection of coincident 

tive at one output port which we label C, and fully destruc- signals in the two branches of the detector is determined and 

tive at the other output port which we label D. So for these compared with a threshold to detect the presence of an 

cases the photons behave deterministically at the final cou- 65 eavesdropper. 

pier in the interferometer and will always be detected at C. 2. A method according to claim 1, in which the intensity 

(Note that the output port at which the photon is detected of the single-photon from the highly attenuated source is 
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such that the average number of photons per time slot is very 
much less than 1. 

3. A method according to claim 1, in which the step of 
determining the rate of detection of coincident signals and 
comparing with a threshold is carried out in a control 
processor (54; FIG. 4) linked to at least one single -photon 
detector (43,44), after the detection of the signals. 

4. A method according to claim 1, in which the single - 
photons are modulated using a four-state encoding basis, and 
the step of detecting the rate of detection of coincident 
signals is carried out for those single-photon signals deter- 
mined to have been modulated and detected using different 
respective bases. 

5. A method according to claim 1, in which the single - 
photon signal is modulated using an encryption basis com- 
prising two non-orthogonal states, and the step of detecting 
the rate of coincidence is carried out in relation to signals 
determined at the receiver to have been encoded with a 
known state at the transmitter. 

6. A method according to claim 1, in which the single- 
photon signal is output onto an optical fibre connection 
linking a transmitter and receiver, a secret quantum crypto- 
graphic key being established between the transmitter and 
receiver using data encoded on the modulated single-photon 
signal. 
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7. A method according to claim 1, in which the single- 
photon signal is output onto a multiple -access network (N; 
FIG. 5), and each of a plurality of receivers connected to the 
multiple-access network establishes its own respective 

5 quantum cryptographic key. 

8. A communication system for use in a method of 
quantum cryptography comprising a transmitter (T) includ- 
ing a highly-attenuated optical source, one or more receivers 

io (R1-R3) and a network (N) linking the transmitter to the or 
each receiver, characterised in that the or each receiver 
includes means for determining the rate of detection of 
coincident signals in branches of the receiver corresponding 
to different encoded states and compares the rate of detection 

35 with a threshold to detect the presence of an eavesdropper. 

9. A system according to claim 8, in which the network is 
an optical fibre network. 

10. A system according to claim 8, in which the network 
2Q is a multiple access network connected to a plurality of 

receivers (R1-R3). 

***** 
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